Root CORE file created 3

[KOG]

Hi

Is there a way I can find out how and why the CORE file was created on / directory?

drwxr-x--- 2 root audit 512 24 Oct 2002 audit
lrwxrwxrwx 1 bin bin 8 24 Oct 2002 bin -> /usr/bin
-rw-rw-r-- 1 root system 8835072 06 Jun 21:47 core
drwxrwxr-x 5 root system 3072 13 Mar 19:38 dev


Thanking you in advance.

K

 

[KenCunningham]

strings /core | pg should give you whatever it can find within the file in ascii, and might help you to find which process caused this core file.

HTH.

 

[KOG]

Hi

The core file outputs is quite large and I have no idea what the error messages mean?

Signal 52
Signal 53
Signal 54
Signal 55
Signal 56
Signal 57
Signal 58
CPU Failure Predicted
Monitor mode granted
Monitor mode retracted
Sound completed
Secure attention
@(#)96
1.3 src/bos/usr/ccs/lib/libc/siglist.c, libcproc, bos43N, 9917A_43N 4/15/99 08:47:56
@(#)95 1.1.1.1 src/bos/usr/ccs/lib/libc/siginter.c, libcproc, bos430, 9737A_430 2/12/97 12:57:49
XPG_SUS_ENV
ÿÿÿÿ@(#)99 1.3.1.1 src/bos/usr/ccs/lib/libc/sigpause.c, libcproc, bos430, 9737A_430 2/12/97 12:58:07
@(#)01
1.3 src/bos/usr/ccs/lib/libc/ssignal.c, libcproc, bos430, 9737A_430 5/22/97 18:01:04
@(#)04
1.5 src/bos/usr/ccs/lib/libc/hsearch.c, libcsrch, bos430, 9737A_430 8/22/97 09:11:05
@(#)06
1.2 src/bos/usr/ccs/lib/libc/lsearch.c, libcsrch, bos430, 9737A_430 5/27/94 13:34:28
@(#)08
1.3 src/bos/usr/ccs/lib/libc/tsearch.c, libcsrch, bos430, 9737A_430 5/27/94 13:34:09
@(#)96
1.2.1.2 src/bos/usr/ccs/lib/libc/wcsxfrm.c, libcstr, bos430, 9737A_430 1/12/93 11:20:53
@(#)16
1.1 src/bos/usr/ccs/lib/libc/wcscmp.c, libcstr, bos430, 9737A_430 2/26/91 17:49:28
@(#)23
1.1 src/bos/usr/ccs/lib/libc/wcsncmp.c, libcstr, bos430, 9737A_430 2/26/91 17:49:56
@(#)14
1.1 src/bos/usr/ccs/lib/libc/wcscat.c, libcstr, bos430, 9737A_430 2/26/91 17:49:20
@(#)15
1.1 src/bos/usr/ccs/lib/libc/wcschr.c, libcstr, bos430, 9737A_430 2/26/91 17:49:24
@(#)20
1.1 src/bos/usr/ccs/lib/libc/wcscspn.c, libcstr, bos430, 9737A_430 2/26/91 17:49:45
@(#)22 1.2.1.2 src/bos/usr/ccs/lib/libc/wcsncat.c, libcstr, bos430, 9737A_430 3/6/97 15:32:00
@(#)25
1.1 src/bos/usr/ccs/lib/libc/wcspbrk.c, libcstr, bos430, 9737A_430 2/26/91 17:50:04
@(#)27
1.2 src/bos/usr/ccs/lib/libc/wcsspn.c, libcstr, bos430, 9737A_430 1/12/93 11:20:39
@(#)28
1.5 src/bos/usr/ccs/lib/libc/wcstok.c, libcstr, bos430, 9737A_430 7/3/97 11:06:32
@(#)29
1.3 src/bos/usr/ccs/lib/libc/wcsstr.c, libcstr, bos430, 9737A_430 6/26/97 06:58:07
@(#)17
1.3.1.2 src/bos/usr/ccs/lib/libc/wcscoll.c, libcstr, bos430, 9737A_430 1/12/93 11:20:16
@(#)15 1.8.1.2 src/bos/usr/ccs/lib/libc/execle.c, libcsys, bos43D, 9810A_43D 2/25/98 20:21:13
@(#)26
1.7 src/bos/usr/ccs/lib/libc/stime.c, libctime, bos430, 9737A_430 6/16/90 01:34:30
@(#)24
1.3 src/bos/usr/ccs/lib/libc/vlimit.c, libcsys, bos430, 9737A_430 2/15/97 14:17:18
@(#)13
1.9 src/bos/usr/ccs/lib/libc/difftime.c, libctime, bos430, 9737A_430 8/21/92 14:19:10
@(#)28
1.2.1.3 src/bos/usr/ccs/lib/libc/nanotimers.c, libctime, bos43D, 9749A_43D 12/4/97 05:40:47
@(#)68
1.8 src/bos/usr/ccs/lib/libc/settimeofday.c, libctime, bos430, 9737A_430 6/16/90 01:34:25
@(#)37
1.1 src/bos/usr/ccs/lib/libc/AFfndrec.c, libcgen, bos430, 9737A_430 12/14/89 17:36:09
@(#)39
1.1 src/bos/usr/ccs/lib/libc/AFgetrec.c, libcgen, bos430, 9737A_430 12/14/89 17:38:22
@(#)44
1.1 src/bos/usr/ccs/lib/libc/AFrewind.c, libcgen, bos430, 9737A_430 12/14/89 17:42:52
/dev/console
%s%s%s
%s%s%s
%s: %s: %s
%s: %s%s
%s%s
TO FIX: %s %s
%s%s
%s%s: %s
MSGVERB
SEV_LEVEL
HALT
ERROR
WARNING
INFO
label
severity
text
action
%s%s: %s
%s%s
TO FIX: %s %s
%s%s
%s: %s%s
%s: %s: %s
%s%s%s
%s%s%s
/dev/console
@(#)83
1.2.1.2 src/bos/usr/ccs/lib/libc/fmtmsg.c, libcfmt, bos430, 9737A_430 5/22/97 17:31:43
%m/%d/%y
%H:%M
%H:%M:%S
DATEMSK
+@(#)84
1.3.1.5 src/bos/usr/ccs/lib/libc/getdate.c, libcfmt, bos43R, r1999_46A2 10/1/99 00:38:10
@(#)85
1.1 src/bos/usr/ccs/lib/libc/getsubopt.c, libcenv, bos430, 9737A_430 3/4/94 10:29:03
@(#)86
1.4 src/bos/usr/ccs/lib/libc/realpath.c, libcenv, bos43N, 9927A_43N 6/28/99 14:55:00
@(#)33
1.2 src/bos/usr/ccs/lib/libc/fattach.c, libcfs, bos430, 9737A_430 7/3/97 10:11:04
@(#)25 1.1.1.2 src/bos/usr/ccs/lib/libc/ptsname.c, libctty, bos43K, 9831A_43K 7/27/98 10:58:44
libc.a(pty.o)
@(#)24 1.4 src/bos/usr/ccs/lib/libc/grantpt.c, libctty, bos43N, 9930A_43N 7/6/99 15:47:42
@(#)26 1.1.1.2 src/bos/usr/ccs/lib/libc/unlockpt.c, libctty, bos43K, 9831A_43K 7/27/98 10:58:13
@(#)11 1.1 src/bos/usr/ccs/lib/libc/trunc.c, libcfs, bos430, 9737A_430 11/17/95 15:04:05
@(#)08 1.1 src/bos/usr/ccs/lib/libc/fclear.c, libcfs, bos430, 9737A_430 11/17/95 15:03:56
@(#)09 1.1 src/bos/usr/ccs/lib/libc/lockf.c, libcfs, bos430, 9737A_430 11/17/95 15:03:59
@(#)10 1.2 src/bos/usr/ccs/lib/libc/mmap.c, libcfs, bos430, 9737A_430 4/10/97 11:49:34
@(#)90
1.7 src/bos/usr/ccs/lib/libc/select_fd_macros.c, sysios, bos43D, 9809B_43D 3/3/98 09:35:27
@(#)76
1.3 src/bos/usr/ccs/lib/libc/bsd_signal.c, libcsig, bos430, 9737A_430 3/1/96 11:16:48
/etc/utmp
/etc/utmp
ÿÿÿÿ
µP@(#)55
1.1 src/bos/usr/ccs/lib/libc/getutmpx.c, libc, bos430, 9737A_430 1/10/96 17:02:29
mbswidth:malloc
mbswidth:malloc
@(#)55 1.4.1.1 src/bos/usr/ccs/lib/libc/mbswidth.c, libcnls, bos430, 9737A_430 2/12/97 12:42:38
@(#)68 1.1.1.1 src/bos/usr/ccs/lib/libc/set_speed.c, libctty, bos430, 9737A_430 2/12/97 12:55:15
@(#)69 1.1.1.1 src/bos/usr/ccs/lib/libc/reset_speed.c, libctty, bos430, 9737A_430 2/12/97 12:53:22
@(#)67 1.1.1.1 src/bos/usr/ccs/lib/libc/get_speed.c, libctty, bos430, 9737A_430 2/12/97 12:28:51
POSIX
@(#)74 1.2.3.2 src/bos/usr/ccs/lib/libc/strncollen.c, libcnls, bos430, 9737A_430 7/5/97 13:18:18
@(#)75 1.2.1.1 src/bos/usr/ccs/lib/libc/strtows.c, libcnls, bos430, 9737A_430 2/12/97 13:01:32
@(#)91
1.3 src/bos/usr/ccs/lib/libbsd/ftime.c, libbsd, bos430, 9737A_430 3/4/94 10:11:33
@(#)93
1.6 src/bos/usr/ccs/lib/libbsd/valloc.c, libbsd, bos430, 9737A_430 8/19/97 10:35:27
@(#)31
1.2 src/bos/usr/ccs/lib/libbsd/vfork.c, libbsd, bos430, 9737A_430 6/16/90 01:33:34
@(#)33
1.9 src/bos/usr/ccs/lib/libc/POWER/ucontext.c, libcproc, bos43N, 9920A_43N 2/24/98 09:30:41
@(#)62
1.1 src/bos/usr/ccs/lib/libc/ndbm_macros.c, libcndbm, bos430, 9737A_430 1/29/96 13:18:50
@(#)30
1.12 src/bos/usr/ccs/lib/libPW/regcmpPW.c, libPW, bos430, 9737A_430 5/22/97 15:34:56
alpha
upper
lower
digit
alnum
space
print
punct
xdigi

Any chance of uploading the file for advice?

Thanking you in advance.

Regards

K

 

[KenCunningham]

Sorry - way out of my league I think! Don't like the look of that 'CPU failure predicted' portion though. No doubt someone will be able to help further when the US wakes up. Regards.

 

[vivek1712]

Hi,

Try "strings core |grep _="
or
"lquerypv -h core 6b0 64"

U will find the program name in 5th col.

Rgds,
vivek

 

[AIXSPadmin]

Actually, run both the `strings` and `lquerypv` commands as listed by vivek.

One lists the executable that caused the core and the other prints the actual binary or script that caused it.

 

[MoshiachNow]

Hi,

There is the way I deal with core files:

1.WHen the core file is created in errot ALWAYS there will be an entry:
"SOFTARE PROGRAM ABNORMALLY TERMINATED"

To identify all reasons for core files that caused the above I cut&paste the following AS IS into a shell:
============================
ksh
if [[ `oslevel |cut -d. –f 1` = “5” ]] ;then
ERROR=”AD2BA772”
else
ERROR=”C60BB505”
fi
DATE1=`errpt -a -j $ERROR | grep Date | awk '{ print $5 }' | cut -d: -f 1,2 |head -1`
for SEQUENCE in `errpt -a -j $ERROR |grep Sequence|cut -d: -f2`
do
DATE2=`errpt -a -j $ERROR -l $SEQUENCE | grep Date | awk '{ print $5 }' | cut -d: -f 1,2`
if [[ $DATE1 != $DATE2 ]] ;then
echo “`errpt -l $SEQUENCE -a | grep Date | awk '{ print $3,$4,$5 }'` \c\t”
errpt -a -j $ERROR -l $SEQUENCE | awk '/PROGRAM NAME/,/ADDITIONAL INFORMATION/' | grep -vE "PROG|ADD"
DATE1=$DATE2
fi
done
exit
===============================================
This displays all reasons for ALL cores generated in the system.
Sample output:

Jul 29 14:10:51 DHReporter
Jul 25 17:06:42 managerLS
Jul 25 17:02:34 DHReporter
Jul 25 16:59:18 DHReporter
Jul 24 16:09:20 splr_control
Jul 24 16:03:19 ftc_repair
Jul 24 16:02:43 ftc_repair
Jul 24 08:57:05 import
Jul 24 08:56:45 import
Jul 24 08:39:07 ftc_repair
Jul 24 08:38:59 ftc_repair
Jul 24 08:37:14 import


"Long live king Moshiach !"

http://www.7for70.com/

 

[usige]

You can find what prog caused the core dump simply by running:

file /core

It should tell you if it's a 32-bit or 64-bit dump, if it's a full dump, and finally what program it was.

As for why the prog my have cored... You could look in errpt (errpt -aN SYSPROC) - it should tell you what sig caused the core - or possible use gdb/dbx. If it's a core for a prog you don't have source for then the debuggers won't be a lot of help.

 

[MoshiachNow]

Exellent method ,usige !

However the above posted small ksh thing gives all the reasons for the core files recorded in the errpt,giving a good troubleshooting history info.

The problem is that he core files are overwritten by any application writing core files to the same directory...


"Long live king Moshiach !"

http://www.7for70.com/